Data anomaly detection using a large language model

Abstract

Disclosed are systems and methods that process a dataset to determine data anomalies in the dataset. The process may receive a query to create the dataset. At least one known data anomaly may be identified in the dataset. An algorithm that models a pattern of the dataset may be selected. The dataset, known data anomaly, and/or algorithm may be sent to a Large Language Model (LLM) with instructions to determine configuration information for data anomaly detection including at least one threshold that indicates additional anomalies in the dataset. The algorithm may create a reference dataset that is compared to the dataset to determine deviations. The threshold may determine which deviations indicate additional anomalies. The LLM may send configuration data, including at least the threshold, to an anomaly detection application, which may be configured with the configuration data and used to determine data anomalies in other, similar, datasets generated with the query or a similar query.

What is claimed: 
     
         1 . A computer-implemented method, comprising:
 receiving a query that, when executed, extracts a first dataset from a data source, the first dataset including a time stamp associated with at least an actual count of an event;   executing the query to obtain the first dataset;   receiving an indication of at least one time stamp that includes at least one known data anomaly in the first dataset;   analyzing the first dataset to determine an algorithm that calculates a second dataset including second data points that represent a distribution of first data points in the first dataset;   executing the algorithm to generate the second dataset that includes the time stamp associated with at least a predicted count of the event;   determining deviations between the first dataset and the second dataset by comparing the second data points in the second dataset to the first data points in the first dataset to determine a deviation for the event for each time stamp;   determining, using a Large Language Model (LLM), a threshold for the deviations based at least in part on the deviations and the at least one known data anomaly in the first dataset, the threshold indicating additional anomalies in the first dataset; and   creating a data anomaly detector that includes at least the query, the algorithm, and the threshold to determine the additional anomalies in the first dataset.   
     
     
         2 . The computer-implemented method of  claim 1 , wherein:
 the analyzing the first dataset to determine an algorithm further includes at least one of:
 calculating a confidence score based on a comparison between the first data points of the first dataset and the second data points of the second dataset; or 
 calculating a noise score indicating an amount of anomalies in the first dataset; and 
   the determining the algorithm is based at least in part on the confidence score, the noise score, or both.   
     
     
         3 . The computer-implemented method of  claim 1 , wherein:
 the analyzing the first dataset to determine the algorithm includes sending the first dataset to the LLM with at least the at least one known data anomaly to determine the algorithm.   
     
     
         4 . The computer-implemented method of  claim 1 , wherein the algorithm is a first algorithm, and further comprising:
 determining a second algorithm that calculates a third dataset including third data points that represent the distribution of first data points in the first dataset, the third data points being different than the second data points generated by the second algorithm;   determining second deviations between the first dataset and the third dataset by comparing the third data points in the third dataset to the first data points in the first dataset to determine a second deviation for the event for each time stamp; and   determining, using the LLM, a second threshold for the second deviations based at least in part on the second deviations and the at least one known data anomaly in the first dataset, the second threshold indicating further anomalies in the first dataset.   
     
     
         5 . The computer-implemented method of  claim 1 , wherein:
 the threshold is selected to indicate an amount of anomalies as a threshold percentage of the first data points of the first dataset.   
     
     
         6 . The computer-implemented method of  claim 1 , wherein:
 the analyzing the first dataset to determine the algorithm includes excluding the at least one known data anomaly from the first dataset when determining the algorithm.   
     
     
         7 . The computer-implemented method of  claim 1 , wherein:
 the first data includes data indicating a device type, and   the data anomaly detector determines anomalies by the device type.   
     
     
         8 . A computer system, comprising:
 one or more processors; and   memory storing program instructions that, when executed by the one or more processors, cause the one or more processors to at least:
 receive a first dataset of first data points that include a time stamp associated with at least an actual value for an event; 
 receive an indication of at least one time stamp that includes at least one known data anomaly in the first dataset; 
 send at least the first data and the at least one known data anomaly to a Large Language Model (LLM) with instructions that cause the LLM to at least:
 determine an algorithm that calculates a second dataset including second data points that represent a predicted value for a distribution of first data points in the first dataset; 
 determine a threshold for deviations between the first dataset and the second dataset based at least in part on the deviations and the at least one known data anomaly in the first dataset, the threshold indicating additional anomalies in the first dataset; and 
 
 receive, from the LLM, at least the algorithm and the threshold; and 
 determine the additional anomalies in the first dataset using at least the algorithm and the threshold. 
   
     
     
         9 . The computer system of  claim 8 , wherein the program instructions that when executed by the one or more processors further cause the one or more processors to at least:
 include in the instructions a request to exclude a data point with the time stamp associated with the at least one known data anomaly during determination of the algorithm.   
     
     
         10 . The computer system of  claim 8 , wherein the program instructions that when executed by the one or more processors further cause the one or more processors to at least:
 include in the instructions a threshold percentage of anomalies to be detected using the deviations and threshold, the threshold percentage to be used by the LLM in part to determine the threshold.   
     
     
         11 . The computer system of  claim 8 , wherein:
 the instructions are first instructions, and   the program instructions that when executed by the one or more processors further cause the one or more processors to at least:
 send at least the first data and the at least one known data anomaly to the LLM with second instructions that cause the LLM to at least:
 determine a second algorithm that calculates a third dataset including third data points that represent the distribution of first data points in the first dataset, the third data points being different than the second data points; 
 determine second deviations between the first dataset and the third dataset by comparing the third data points in the third dataset to the first data points in the first dataset to determine a second deviation for the event for each time stamp; and 
 determine a second threshold for the second deviations based at least in part on the second deviations and the at least one known data anomaly in the first dataset, the second threshold indicating further anomalies in the first dataset; and 
 
 receive, from the LLM, at least the second algorithm and the second threshold; and 
 select at least one of the first algorithm or the second algorithm to provide data anomaly detection of the first data. 
   
     
     
         12 . The computer system of  claim 8 , further comprising:
 receiving a simulated data anomaly for association with the first dataset, the simulated data anomaly including a simulated value and being designated as at least part of the at least one known data anomaly.   
     
     
         13 . The computer system of  claim 8 , wherein:
 the deviation is expressed as a percentage based on a difference between the predicted value and the actual value for each time stamp.   
     
     
         14 . The computer system of  claim 8 , wherein:
 the threshold is selected to indicate a quantity of anomalies as a threshold percentage of the first data points of the first dataset.   
     
     
         15 . A method, comprising:
 receiving a first dataset of first data points associated with at least an actual value for an event;   sending at least the first data and first instructions to a Large Language Model (LLM), the first instructions including at least:
 determining an algorithm that calculates a second dataset including second data points that represent a predicted value for a distribution of first data points in the first dataset; 
   receiving, from the LLM, at least the algorithm;   determining at least one data anomaly in the first dataset based at least in part on a comparison between the first dataset and the second dataset;   sending at least the first data, an indication of the at least one data anomaly, and second instructions to a Large Language Model (LLM), the second instructions including at least:
 determining a threshold for deviations between the first dataset and the second dataset based at least in part on the deviations and the indication of the at least one data anomaly in the first dataset, the threshold indicating additional anomalies in the first dataset; 
   receiving, from the LLM, the threshold;   determining the additional anomalies in the first dataset using at least the algorithm and the threshold.   
     
     
         16 . The method of  claim 15 , further comprising:
 designating at least one of the additional anomalies as a verified data anomaly; and   sending at least the first data, the verified data anomaly, and additional instructions to the LLM to update at least one of the algorithm or the threshold.   
     
     
         17 . The method of  claim 15 , further comprising:
 the first dataset further includes a second actual value for the event;   the first instructions further cause the LLM to group at least some of the first data points based on the second actual value to create the algorithm; and   the second instructions further cause the LLM to group at least some of the first data points based on the second actual value to create the threshold.   
     
     
         18 . The method of  claim 15 , wherein:
 the first dataset includes time-series data that includes at least a time stamp and at least one field having a count of an action associated with the event.   
     
     
         19 . The method of  claim 15 , wherein:
 The threshold is based on at least one of a statistical deviation or a percentage difference between corresponding instances of the first data points and the second data points.   
     
     
         20 . The method of  claim 15 , wherein the first instructions further include:
 causing the LLM to ignore the at least one known data anomaly when determining the algorithm.